Posts

CPRA vs CCPA

CPRA Vs CCPA? Ready for the July 2023 Deadline?

Today’s businesses operate in a global landscape where data privacy and security compliance are more complex than ever. Case in point, there is a significant amount of uncertainty about the upcoming CPRA requirements and how it differs from the CCPA. Let’s look at CPRA vs. CCPA.

[ez-toc]

CPRA vs CCPA

CPRA Vs CCPA

The California Privacy Rights Act strengthens the consumer privacy rights outlined in the CCPA and establishes new data security requirements for businesses with enforcement beginning on July 1, 2023.

Businesses must protect the privacy of personal information, including taking steps to implement authentication procedures, updating policies, and securing user data. In addition, businesses must comply with CPRA by July 1, 2023, or face potential fines, lawsuits, and more.

In terms of CPRA vs. CCPA, it is important to note that the CPRA does not replace the CCPA. Instead, the CPRA amends CCPA by adding clarifications and strengthening provisions.

What is the California Consumer Privacy Act (CCPA)?

Enacted in 2018, the CCPA was the first significant privacy law in the US after the EU adopted the General Data Protection Regulation (GDPR).

The CCPA is a baseline law that created consumer privacy protections like the right to know what personal information a business collects and shares. It required companies to provide notice of their data practices and more. It applies to all businesses operating in California, whether they have a presence in the state or not.

The CCPA requires businesses to provide certain notices and disclosures, such as a dedicated privacy policy, to individuals before collecting their personal information.

What is the California Privacy Rights Act (CPRA)?

The CPRA builds upon the CCPA by further expanding consumer privacy rights and strengthening data protection requirements. For example, the CPRA grants consumers even more control over their personal information by requiring businesses to obtain explicit consent for data processing activities outside the scope of contractual necessity or legal obligation. It also adds more data security requirements and expands the scope of data security procedures covered by the law.

Key Differences Between CCPA and CPRA

Businesses should note that the main distinction between the CCPA and CPRA is the addition of strict consumer data privacy and security provisions. For example, the creation of a new category of sensitive personal information expands the data types that are subject to greater protection measures. Additionally, the mandatory cybersecurity and risk assessments and third-party audits required for some businesses will add additional layers of complexity to compliance programs.

 CPRA Data Security Updates

Here are some data security requirements outlined in the CPRA:

  1. Reasonable security measures: California privacy law expects businesses to implement “reasonable” security measures to protect the personal data they collect.
  2. Sensitive personal information protection: CPRA expands the categories of personal information, and businesses must employ reasonable security measures to protect this data, including encryption and access controls.
  3. Annual security audits: The CPRA requires that businesses performing higher-risk processing (as defined by the CPPA) conduct annual cybersecurity and risk assessments, as well as vulnerability assessments and penetration testing.
  4. Third-party vendor security: Companies must conduct due diligence on vendors that handle personal information, ensure they have adequate data protection measures in place, and only transfer data to vendors with confidentiality agreements in place.
  5. Training and education: Businesses must train their employees to manage personal data and ensure they understand how to protect it.
  6. Data breaches: The CPRA now considers email account leaks as data breaches, particularly if such leaks result in the exposure of personal details linked to people residing in California, as well as when security question leaks occur.
  7. Data minimization and retention: Companies must limit the data they collect, store, and retain to a reasonable amount necessary for their operations.

Potential Consequences of Non-Compliance

The potential outcomes of non-compliance are significant. The CPRA clarifies consumers’ rights to sue for violations and creates the California Privacy Protection Agency (CPPA) to enforce the CCPA and CPRA. Companies that violate the laws can face hefty fines and sanctions, including criminal penalties or suspension of the company’s ability to conduct business in the state. Additionally, organizations that fail to comply could become subject to costly and time-consuming lawsuits.

Announced in August 2022, the first enforcement action of the CCPA was a $1.2 million settlement against Sephora for neglecting to inform consumers about the sale of their data and to adequately process sale consumer opt-outs.

Enforcement actions are expected to increase after the full force of the CPRA goes into effect in July 2023.

How to Navigate a Changing Regulatory Landscape

It is critical to know what data your business collects and how it is secured to ensure compliance with the CCPA and the CPRA. Working with an IT partner that understands data privacy laws and regulations and data security requirements is essential for organizations looking to stay compliant in this increasingly regulated environment.

Your organization may also be required to follow additional requirements like the European GDPR or New Yorks’s Shield Act. By enlisting the services of a qualified IT services provider, organizations can make certain they are up to date on all the latest regulations and utilizing best practices for data protection. In addition, having an experienced IT partner means businesses can avoid disruptions and safeguard operations and focus on growing their bottom line.

Related Content → Read about how a GRC-enabled solution can streamline and simplify compliance  Understanding Governance, Risk Management, and Compliance for Financial Services.

 

by
NY SHIELD Act Data Privacy Laws

The NY SHIELD Act: What You Need to Know

As data breaches increase in frequency and severity, regulators are implementing new data privacy laws to reduce consumer risk.

Currently, there are no comprehensive data security or privacy laws at the federal level. As a result, individual states are implementing laws to protect their residents. Unfortunately, this creates a complex maze of overlapping data privacy laws businesses must follow. The NY Shield Act is an example of one of these laws.

[ez-toc]

NY SHIELD Act Data Privacy Laws

What is the NY Shield Act?

The NY Shield Act, or Stop Hacks and Improve Electronic Data Security Act, is a set of laws that require businesses to take specific steps to ensure the security and privacy of sensitive customer data. Implemented in 2020, it amended the New York state’s existing data breach notification law to impose stricter data security requirements on companies to protect consumers’ personally identifiable information from misuse, breach, or unauthorized access.

Who Needs to Comply with the NY Shield Act?

The NY Shield Act applies to all companies operating in New York State or gathering information from residents of New York, even if they are not based in New York or the United States.

What’s Required of Businesses?

Businesses must implement a Data Security Program and reasonable safeguards to ensure private information is stored and erased safely. This prescription includes physical, technical, and administrative controls to protect sensitive information. Additionally, businesses must notify customers whose data has been compromised if a breach occurs.

What Are the Consequences of Non-Compliance?

Businesses must take “reasonable” steps to comply with the NY Shield Act. Companies that fail to take these steps or lack proper security measures could face fines and penalties. Fines for non-compliance start at $5,000 up to a maximum of $250,000, and the state Attorney General can also initiate a civil action case and levy penalties against violators.

Recent civil actions lawsuits for violations of the Shield Act include:

  • Wegman’s agreed to pay $400,000 in penalties in June 2022 after it was discovered that cloud storage containers hosted on Microsoft Azure were left unsecured and open to public access, potentially exposing consumers’ data.
  •  A 2020 agreement with EyeMed that resolved a 2020 data breach that compromised the personal information of approximately 2.1 million consumers nationwide required that the company pay $600,000 in penalties.
  • In 2022, the NY AG and 45 other Attorneys General received $1.25 million from Carnival Cruiseline as part of a multistate settlement after a 2019 data breach exposed the personal information of 180,000 Carnival employees and customers nationwide.

 

“In the 21st century, there’s no excuse for companies to have poor cybersecurity systems and practices that hurt consumers,” wrote NY Attorney General Letitia James regarding the Wegman’s settlement.

Is this like CCPA?

Yes and no. CCPA is a data privacy law, while the SHIELD Act is a security regulation. The California Consumer Privacy Act focuses on data privacy, and the NY SHIELD Act is a security law. The CPRA, a later update to the CCPA, includes data security provisions.

The main takeaway is that, just as with the CCPA, businesses must comply with the Shield Act if it conducts business in the state or collect information from residents, even if the company is located outside the state.

What Are the Key Requirements of the SHIELD Act?

The NY Shield Act requires companies to:

  • Implement security measures appropriate for the size, scope, and type of business.
  • Ensure their service providers maintain the same level of data security as you do.
  • Create a written Information Security Program to protect sensitive customer information from unauthorized access or use.
  • Regularly assess and test the security of your systems.
  • Provide training to your staff on security and privacy best practices.
  • Notify customers in a timely manner in the event of a data breach.

How Can I Comply with the NY Shield Act?

The best way to comply with the NY SHIELD Act is to create an Information Security Program that addresses the requirements of the law. The program should include policies and procedures for protecting sensitive information, such as multifactor authentication and access control measures, regularly testing your systems, training staff on data security best practices, and providing timely notification to customers in the event of a breach. You should also ensure that any third-party vendors you use are compliant.

Data Security vs. Data Privacy: What’s the Difference?

It’s essential to understand that data security and data privacy are not interchangeable terms. While both aim to protect data, they focus on different aspects. Data privacy focuses on individuals and their rights to protect their personal information from being used by companies and governments without consent. Data security protects against unauthorized access to sensitive information by employees, bad actors, or malicious software. Ultimately, the goal is to ensure that data remains safe so that organizations and consumers can trust that their data is being used as intended.

Next Steps for Compliance

The NY SHIELD Act is a vital law for protecting sensitive information and maintaining consumer trust in an organization. Business executives must ensure full compliance with the law, including implementing a data security program, performing routine assessments, and appropriately responding to security incidents. Working with an IT partner experienced with the Shield Act and other data privacy laws and regulations is ideal. Protecting customer data is essential in today’s digital world and can only be achieved through implementing effective security measures.

by
GDPR Requirements

GDPR Requirements: What You Need to Know (2023)

Businesses today are in a race to become more connected and technologically advanced. With more data available than ever, organizations must implement measures to protect sensitive information from cyber threats and misuse.

This directive becomes even more vital considering the crisscrossing data privacy laws from various sources, including the General Data Protection Regulation (GDPR). While you are most likely familiar with this regulation, it is essential to understand what it entails and how it impacts your organization. Read on to learn more about the GDPR requirements impacting you and your business.

[ez-toc]

GDPR Requirements

What is GDPR?

The General Data Protection Regulation (GDPR) was enacted to protect consumer data privacy rights in the European Union. All organizations that manage customer data will be held responsible for its proper handling, regardless of location. Thus, any non-European organization that handles or collects the personal data of EU citizens is subject to GDPR.

GDPR compliance is vital for organizations seeking to protect their customers and business reputation. Non-compliance can result in personal liability, job loss, huge fines, administrative penalties, and more.

7 Must-Know GDPR Requirements

  1. Who does it apply to? GDPR applies to any business that collects, stores, or processes personal data from individuals in the EU, regardless of the company’s location.
  2. What types of data privacy does it cover? The GDPR protects a wide range of personal information, including names, addresses, email addresses, phone numbers, photos and videos, biometric information such as fingerprints and retinal scans, IP addresses, web cookies and browsing history, and more.
  3. What are the requirements of GDPR? GDPR requires companies to obtain explicit consent for data collection, protect personal data, provide access to data subject requests, and notify authorities about data breaches.
  4. What should companies do to comply? First, companies should appoint a Data Protection Officer, perform regular data protection impact assessments, and provide employee training.
  5. What about GDPR and third-party risk management? The GDPR requires companies to establish contractual agreements with third parties to ensure compliance with the GDPR’s data protection requirements. In other words, you are responsible for the activities and compliance of your third-party vendors regarding data from the EU.
  6. What are the consequences of non-compliance? The penalties for non-compliance with GDPR can be up to 4% of global revenue or €20 million, whichever is greater. Furthermore, failure to report a breach in time can cause fines as high as €10 million, which is on top of the cost of notification and any business losses caused by the breach. In addition, non-compliance may result in lawsuits from impacted consumers, business disruption, and reputational damage.
  7. What are GDPR’s implications for data breaches? GDPR requires companies to notify authorities and affected individuals about data breaches within 72 hours of discovery.

Next Steps for Ensuring GDPR Compliance?

The best way for business executives to ensure that their organizations comply with GDPR is to create a comprehensive data privacy and security plan.

  • Conduct a data audit: Identify the personal data your business processes, where it comes from, and who has access to it.
  • Update your privacy policy: Ensure your privacy policy is written in clear language and includes information on how personal data is collected, used, and processed.
  • Obtain appropriate consent: Obtain explicit consent from individuals for collecting, processing, and using their personal data.
  • Implement appropriate security measures: Implement technical and organizational measures, such as encryption and access controls, to protect personal data.
  • Train employees: Educate employees on GDPR compliance and appoint a data protection officer to oversee compliance efforts.

The Data Privacy and Security Landscape

Of course, GDPR is not the only set of regulations you need to worry about regarding data privacy and security. In response to the growing threats from data breaches, your firm must address a whole set of overlapping laws. From other regional regulations like the California Consumer Protection Act to industry-specific requirements, your firm must comply with a complicated compliance matrix.

Working with an IT partner can ensure that your firm utilizes the best practices for all the required regulations and reduce your risk exposure. Doing so will enable you to protect client data, streamline compliance obligations, create a secure online environment, and keep you and your firm out of the headlines.

GDPR compliance is essential for organizations that want to protect customer data and safeguard their business reputation. Therefore, companies should take the steps outlined above to ensure they comply with GDPR, such as conducting a data audit, updating privacy policies, obtaining appropriate consent from customers, implementing security measures, and training employees. Ultimately, these steps will help companies avoid any severe penalties or repercussions due to non-compliance with GDPR regulations.

by